CVE-2009-4248: realnetworks helix_player

Modified

Published 25-01-2010Last modified 07-08-2024

Vulnerability summary

CVE-2009-4248 is a high (CVSS 9.3) vulnerability in realnetworks helix_player. EPSS estimates a 6.81% chance of exploitation in the next 30 days, higher than 94% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 9.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

6.81%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2010:0094

Timeline

25-01-2010
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in the RTSPProtocol::HandleSetParameterRequest function in client/core/rtspprotocol.cpp in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted RTSP SET_PARAMETER request.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

6.81%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

No change 0.00 pp

From 6.81% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Realnetworks3 products

helix_player10.0 | 11.0.0 | 11.0.1
realplayer10.0 | 10.5 | 11.0 | 11.0.1 | 11.0.2 | 11.0.3 | 11.0.4 | 11.0.5 | 10.1 | 11.0.0
realplayer_sp1.0.0 | 1.0.1

1 vendor · 3 products

References

15 links

bugzilla.redhat.com/show_bug.cgi?id=561361X Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2010-0094.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2010/0178VDB EntryX Refsource VUPENPatchVendor Advisory
helixcommunity.org/viewcvs/client/core/rtspprotocol.cpp?view=logX Refsource CONFIRM
securitytracker.com/id?1023489VDB EntryX Refsource SECTRACKPatch
service.real.com/realplayer/security/01192010_player/en/X Refsource CONFIRMPatchVendor Advisory
secunia.com/advisories/38450Third Party AdvisoryX Refsource SECUNIA
lists.helixcommunity.org/pipermail/client-dev/2008-January/004591.htmlMailing ListX Refsource MLIST
lists.helixcommunity.org/pipermail/client-cvs/2008-January/003759.htmlMailing ListX Refsource MLIST
helixcommunity.org/viewcvs/client/core/rtspprotocol.cpp?view=logX Refsource CONFIRM

Show all 15 references

secunia.com/advisories/38218Third Party AdvisoryX Refsource SECUNIAVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10641VDB EntrySignatureX Refsource OVAL
lists.helixcommunity.org/pipermail/client-cvs/2008-January/003756.htmlMailing ListX Refsource MLIST
www.securityfocus.com/bid/37880VDB EntryX Refsource BID
exchange.xforce.ibmcloud.com/vulnerabilities/55801VDB EntryX Refsource XF